X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/2ed5325b37efa7aa9d38a60c1d5c8b4980df8489..13fa76866cc2266812df44c410cd5cdfe16d5e73:/sdk/python/arvados/commands/keepdocker.py diff --git a/sdk/python/arvados/commands/keepdocker.py b/sdk/python/arvados/commands/keepdocker.py index 569b3152e9..062545bebe 100644 --- a/sdk/python/arvados/commands/keepdocker.py +++ b/sdk/python/arvados/commands/keepdocker.py @@ -1,5 +1,8 @@ -#!/usr/bin/env python +# Copyright (C) The Arvados Authors. All rights reserved. +# +# SPDX-License-Identifier: Apache-2.0 +from builtins import next import argparse import collections import datetime @@ -7,12 +10,16 @@ import errno import json import os import re -import subprocess import sys import tarfile import tempfile import shutil import _strptime +import fcntl +if sys.version_info[0] < 3: + import subprocess32 as subprocess +else: + import subprocess from operator import itemgetter from stat import * @@ -59,10 +66,10 @@ _group.add_argument( keepdocker_parser.add_argument( 'image', nargs='?', - help="Docker image to upload, as a repository name or hash") + help="Docker image to upload: repo, repo:tag, or hash") keepdocker_parser.add_argument( - 'tag', nargs='?', default='latest', - help="Tag of the Docker image to upload (default 'latest')") + 'tag', nargs='?', + help="Tag of the Docker image to upload (default 'latest'), if image is given as an untagged repo name") # Combine keepdocker options listed above with run_opts options of arv-put. # The options inherited from arv-put include --name, --project-uuid, @@ -98,7 +105,7 @@ def docker_image_format(image_hash): cmd = popen_docker(['inspect', '--format={{.Id}}', image_hash], stdout=subprocess.PIPE) try: - image_id = next(cmd.stdout).strip() + image_id = next(cmd.stdout).decode().strip() if image_id.startswith('sha256:'): return 'v2' elif ':' not in image_id: @@ -111,8 +118,8 @@ def docker_image_format(image_hash): def docker_image_compatible(api, image_hash): supported = api._rootDesc.get('dockerImageFormats', []) if not supported: - logger.warn("server does not specify supported image formats (see docker_image_formats in server config). Continuing.") - return True + logger.warning("server does not specify supported image formats (see docker_image_formats in server config).") + return False fmt = docker_image_format(image_hash) if fmt in supported: @@ -129,6 +136,7 @@ def docker_images(): next(list_output) # Ignore the header line for line in list_output: words = line.split() + words = [word.decode() for word in words] size_index = len(words) - 2 repo, tag, imageid = words[:3] ctime = ' '.join(words[3:size_index]) @@ -182,12 +190,15 @@ def save_image(image_hash, image_file): except STAT_CACHE_ERRORS: pass # We won't resume from this cache. No big deal. +def get_cache_dir(): + return arv_cmd.make_home_conf_dir( + os.path.join('.cache', 'arvados', 'docker'), 0o700) + def prep_image_file(filename): # Return a file object ready to save a Docker image, # and a boolean indicating whether or not we need to actually save the # image (False if a cached save is available). - cache_dir = arv_cmd.make_home_conf_dir( - os.path.join('.cache', 'arvados', 'docker'), 0o700) + cache_dir = get_cache_dir() if cache_dir is None: image_file = tempfile.NamedTemporaryFile(suffix='.tar') need_save = True @@ -315,7 +326,7 @@ def list_images_in_arv(api_client, num_retries, image_name=None, image_tag=None) # and add image listings for them, retaining the API server preference # sorting. images_start_size = len(images) - for collection_uuid, link in hash_link_map.iteritems(): + for collection_uuid, link in hash_link_map.items(): if not seen_image_names[collection_uuid]: images.append(_new_image_listing(link, link['name'])) if len(images) > images_start_size: @@ -338,125 +349,36 @@ def _uuid2pdh(api, uuid): select=['portable_data_hash'], ).execute()['items'][0]['portable_data_hash'] -_migration_link_class = 'docker_image_migration' -_migration_link_name = 'migrate_1.9_1.10' - -def migrate19(): - """Docker image format migration tool for Arvados. - - This converts Docker images stored in Arvados from image format v1 - (Docker <= 1.9) to image format v2 (Docker >= 1.10). - - Requires Docker running on the local host. - - Usage: - - 1) Run arvados/docker/migrate-docker19/build.sh to create - arvados/migrate-docker19 Docker image. - - 2) Set ARVADOS_API_HOST and ARVADOS_API_TOKEN to the cluster you want to migrate. - - 3) Run arv-migrate-docker19 - - This will query Arvados for v1 format Docker images. For each image that - does not already have a corresponding v2 format image (as indicated by a - docker_image_migration tag) it will perform the following process: - - i) download the image from Arvados - ii) load it into Docker - iii) update the Docker version, which updates the image - iv) save the v2 format image and upload to Arvados - v) create a migration link - - """ - - api_client = arvados.api() - - images = arvados.commands.keepdocker.list_images_in_arv(api_client, 3) - - is_new = lambda img: img['dockerhash'].startswith('sha256:') - - count_new = 0 - old_images = [] - for uuid, img in images: - if img["dockerhash"].startswith("sha256:"): - continue - key = (img["repo"], img["tag"], img["timestamp"]) - old_images.append(img) - - migration_links = arvados.util.list_all(api_client.links().list, filters=[ - ['link_class', '=', _migration_link_class], - ['name', '=', _migration_link_name], - ]) - - already_migrated = set() - for m in migration_links: - already_migrated.add(m["tail_uuid"]) - - need_migrate = [img for img in old_images if img["collection"] not in already_migrated] - - logger.info("Already migrated %i images", len(already_migrated)) - logger.info("Need to migrate %i images", len(need_migrate)) - - for old_image in need_migrate: - logger.info("Migrating %s", old_image["collection"]) - - col = CollectionReader(old_image["collection"]) - tarfile = col.keys()[0] - - try: - varlibdocker = tempfile.mkdtemp() - with tempfile.NamedTemporaryFile() as envfile: - envfile.write("ARVADOS_API_HOST=%s\n" % (os.environ["ARVADOS_API_HOST"])) - envfile.write("ARVADOS_API_TOKEN=%s\n" % (os.environ["ARVADOS_API_TOKEN"])) - if "ARVADOS_API_HOST_INSECURE" in os.environ: - envfile.write("ARVADOS_API_HOST_INSECURE=%s\n" % (os.environ["ARVADOS_API_HOST_INSECURE"])) - envfile.flush() - - dockercmd = ["docker", "run", - "--privileged", - "--rm", - "--env-file", envfile.name, - "--volume", "%s:/var/lib/docker" % varlibdocker, - "arvados/migrate-docker19", - "/root/migrate.sh", - "%s/%s" % (old_image["collection"], tarfile), - tarfile[0:40], - old_image["repo"], - old_image["tag"], - col.api_response()["owner_uuid"]] - - out = subprocess.check_output(dockercmd) - - new_collection = re.search(r"Migrated uuid is ([a-z0-9]{5}-[a-z0-9]{5}-[a-z0-9]{15})", out) - api_client.links().create(body={"link": { - 'owner_uuid': col.api_response()["owner_uuid"], - 'link_class': arvados.commands.keepdocker._migration_link_class, - 'name': arvados.commands.keepdocker._migration_link_name, - 'tail_uuid': old_image["collection"], - 'head_uuid': new_collection.group(1) - }}).execute(num_retries=3) - - logger.info("Migrated '%s' to '%s'", old_image["collection"], new_collection.group(1)) - except Exception as e: - logger.exception("Migration failed") - finally: - shutil.rmtree(varlibdocker) - - logger.info("All done") - - -def main(arguments=None, stdout=sys.stdout): +def main(arguments=None, stdout=sys.stdout, install_sig_handlers=True, api=None): args = arg_parser.parse_args(arguments) - api = arvados.api('v1') + if api is None: + api = arvados.api('v1') if args.image is None or args.image == 'images': fmt = "{:30} {:10} {:12} {:29} {:20}\n" stdout.write(fmt.format("REPOSITORY", "TAG", "IMAGE ID", "COLLECTION", "CREATED")) - for i, j in list_images_in_arv(api, args.retries): - stdout.write(fmt.format(j["repo"], j["tag"], j["dockerhash"][0:12], i, j["timestamp"].strftime("%c"))) + try: + for i, j in list_images_in_arv(api, args.retries): + stdout.write(fmt.format(j["repo"], j["tag"], j["dockerhash"][0:12], i, j["timestamp"].strftime("%c"))) + except IOError as e: + if e.errno == errno.EPIPE: + pass + else: + raise sys.exit(0) + if re.search(r':\w[-.\w]{0,127}$', args.image): + # image ends with :valid-tag + if args.tag is not None: + logger.error( + "image %r already includes a tag, cannot add tag argument %r", + args.image, args.tag) + sys.exit(1) + # rsplit() accommodates "myrepo.example:8888/repo/image:tag" + args.image, args.tag = args.image.rsplit(':', 1) + elif args.tag is None: + args.tag = 'latest' + # Pull the image if requested, unless the image is specified as a hash # that we already have. if args.pull and not find_image_hashes(args.image): @@ -470,7 +392,7 @@ def main(arguments=None, stdout=sys.stdout): if not docker_image_compatible(api, image_hash): if args.force_image_format: - logger.warn("forcing incompatible image") + logger.warning("forcing incompatible image") else: logger.error("refusing to store " \ "incompatible format (use --force-image-format to override)") @@ -486,115 +408,131 @@ def main(arguments=None, stdout=sys.stdout): else: collection_name = args.name - if not args.force: - # Check if this image is already in Arvados. - - # Project where everything should be owned - if args.project_uuid: - parent_project_uuid = args.project_uuid - else: - parent_project_uuid = api.users().current().execute( - num_retries=args.retries)['uuid'] - - # Find image hash tags - existing_links = _get_docker_links( - api, args.retries, - filters=[['link_class', '=', 'docker_image_hash'], - ['name', '=', image_hash]]) - if existing_links: - # get readable collections - collections = api.collections().list( - filters=[['uuid', 'in', [link['head_uuid'] for link in existing_links]]], - select=["uuid", "owner_uuid", "name", "manifest_text"] - ).execute(num_retries=args.retries)['items'] - - if collections: - # check for repo+tag links on these collections - if image_repo_tag: - existing_repo_tag = _get_docker_links( - api, args.retries, - filters=[['link_class', '=', 'docker_image_repo+tag'], - ['name', '=', image_repo_tag], - ['head_uuid', 'in', collections]]) - else: - existing_repo_tag = [] - - try: - coll_uuid = next(items_owned_by(parent_project_uuid, collections))['uuid'] - except StopIteration: - # create new collection owned by the project - coll_uuid = api.collections().create( - body={"manifest_text": collections[0]['manifest_text'], - "name": collection_name, - "owner_uuid": parent_project_uuid}, - ensure_unique_name=True - ).execute(num_retries=args.retries)['uuid'] - - link_base = {'owner_uuid': parent_project_uuid, - 'head_uuid': coll_uuid, - 'properties': existing_links[0]['properties']} - - if not any(items_owned_by(parent_project_uuid, existing_links)): - # create image link owned by the project - make_link(api, args.retries, - 'docker_image_hash', image_hash, **link_base) - - if image_repo_tag and not any(items_owned_by(parent_project_uuid, existing_repo_tag)): - # create repo+tag link owned by the project - make_link(api, args.retries, 'docker_image_repo+tag', - image_repo_tag, **link_base) - - stdout.write(coll_uuid + "\n") - - sys.exit(0) - - # Open a file for the saved image, and write it if needed. + # Acquire a lock so that only one arv-keepdocker process will + # dump/upload a particular docker image at a time. Do this before + # checking if the image already exists in Arvados so that if there + # is an upload already underway, when that upload completes and + # this process gets a turn, it will discover the Docker image is + # already available and exit quickly. outfile_name = '{}.tar'.format(image_hash) - image_file, need_save = prep_image_file(outfile_name) - if need_save: - save_image(image_hash, image_file) - - # Call arv-put with switches we inherited from it - # (a.k.a., switches that aren't our own). - put_args = keepdocker_parser.parse_known_args(arguments)[1] + lockfile_name = '{}.lock'.format(outfile_name) + lockfile = None + cache_dir = get_cache_dir() + if cache_dir: + lockfile = open(os.path.join(cache_dir, lockfile_name), 'w+') + fcntl.flock(lockfile, fcntl.LOCK_EX) - if args.name is None: - put_args += ['--name', collection_name] + try: + if not args.force: + # Check if this image is already in Arvados. - coll_uuid = arv_put.main( - put_args + ['--filename', outfile_name, image_file.name], stdout=stdout).strip() + # Project where everything should be owned + parent_project_uuid = args.project_uuid or api.users().current().execute( + num_retries=args.retries)['uuid'] - # Read the image metadata and make Arvados links from it. - image_file.seek(0) - image_tar = tarfile.open(fileobj=image_file) - image_hash_type, _, raw_image_hash = image_hash.rpartition(':') - if image_hash_type: - json_filename = raw_image_hash + '.json' - else: - json_filename = raw_image_hash + '/json' - json_file = image_tar.extractfile(image_tar.getmember(json_filename)) - image_metadata = json.load(json_file) - json_file.close() - image_tar.close() - link_base = {'head_uuid': coll_uuid, 'properties': {}} - if 'created' in image_metadata: - link_base['properties']['image_timestamp'] = image_metadata['created'] - if args.project_uuid is not None: - link_base['owner_uuid'] = args.project_uuid - - make_link(api, args.retries, 'docker_image_hash', image_hash, **link_base) - if image_repo_tag: - make_link(api, args.retries, - 'docker_image_repo+tag', image_repo_tag, **link_base) - - # Clean up. - image_file.close() - for filename in [stat_cache_name(image_file), image_file.name]: - try: - os.unlink(filename) - except OSError as error: - if error.errno != errno.ENOENT: - raise + # Find image hash tags + existing_links = _get_docker_links( + api, args.retries, + filters=[['link_class', '=', 'docker_image_hash'], + ['name', '=', image_hash]]) + if existing_links: + # get readable collections + collections = api.collections().list( + filters=[['uuid', 'in', [link['head_uuid'] for link in existing_links]]], + select=["uuid", "owner_uuid", "name", "manifest_text"] + ).execute(num_retries=args.retries)['items'] + + if collections: + # check for repo+tag links on these collections + if image_repo_tag: + existing_repo_tag = _get_docker_links( + api, args.retries, + filters=[['link_class', '=', 'docker_image_repo+tag'], + ['name', '=', image_repo_tag], + ['head_uuid', 'in', [c["uuid"] for c in collections]]]) + else: + existing_repo_tag = [] + + try: + coll_uuid = next(items_owned_by(parent_project_uuid, collections))['uuid'] + except StopIteration: + # create new collection owned by the project + coll_uuid = api.collections().create( + body={"manifest_text": collections[0]['manifest_text'], + "name": collection_name, + "owner_uuid": parent_project_uuid}, + ensure_unique_name=True + ).execute(num_retries=args.retries)['uuid'] + + link_base = {'owner_uuid': parent_project_uuid, + 'head_uuid': coll_uuid, + 'properties': existing_links[0]['properties']} + + if not any(items_owned_by(parent_project_uuid, existing_links)): + # create image link owned by the project + make_link(api, args.retries, + 'docker_image_hash', image_hash, **link_base) + + if image_repo_tag and not any(items_owned_by(parent_project_uuid, existing_repo_tag)): + # create repo+tag link owned by the project + make_link(api, args.retries, 'docker_image_repo+tag', + image_repo_tag, **link_base) + + stdout.write(coll_uuid + "\n") + + sys.exit(0) + + # Open a file for the saved image, and write it if needed. + image_file, need_save = prep_image_file(outfile_name) + if need_save: + save_image(image_hash, image_file) + + # Call arv-put with switches we inherited from it + # (a.k.a., switches that aren't our own). + put_args = keepdocker_parser.parse_known_args(arguments)[1] + + if args.name is None: + put_args += ['--name', collection_name] + + coll_uuid = arv_put.main( + put_args + ['--filename', outfile_name, image_file.name], stdout=stdout, + install_sig_handlers=install_sig_handlers).strip() + + # Read the image metadata and make Arvados links from it. + image_file.seek(0) + image_tar = tarfile.open(fileobj=image_file) + image_hash_type, _, raw_image_hash = image_hash.rpartition(':') + if image_hash_type: + json_filename = raw_image_hash + '.json' + else: + json_filename = raw_image_hash + '/json' + json_file = image_tar.extractfile(image_tar.getmember(json_filename)) + image_metadata = json.loads(json_file.read().decode()) + json_file.close() + image_tar.close() + link_base = {'head_uuid': coll_uuid, 'properties': {}} + if 'created' in image_metadata: + link_base['properties']['image_timestamp'] = image_metadata['created'] + if args.project_uuid is not None: + link_base['owner_uuid'] = args.project_uuid + + make_link(api, args.retries, 'docker_image_hash', image_hash, **link_base) + if image_repo_tag: + make_link(api, args.retries, + 'docker_image_repo+tag', image_repo_tag, **link_base) + + # Clean up. + image_file.close() + for filename in [stat_cache_name(image_file), image_file.name]: + try: + os.unlink(filename) + except OSError as error: + if error.errno != errno.ENOENT: + raise + finally: + if lockfile is not None: + # Closing the lockfile unlocks it. + lockfile.close() if __name__ == '__main__': main()